File name:

22924839398.zip

Full analysis: https://app.any.run/tasks/20c86a3b-ffac-46b0-bb32-ee605bd80fc5
Verdict: Malicious activity
Analysis date: July 14, 2025, 04:34:19
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

A330FB8B3E1F7A168278DAB0DA54BFB5

SHA1:

2E139922F7B002141824F387AA2E5463DF8623BA

SHA256:

2F8F054E076DD006C42487749B43CA78F59246F79E708854AF368EF547DDEA8E

SSDEEP:

3072:dQbw+kW2GO8x1sLe3H5ubKP3Hk+3YKwzyu58s/k:dEk3GTx1sL45jHk+ILP5f/k

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executing commands from ".cmd" file

      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 2536)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 4408)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 3648)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 1984)

    • Starts application with an unusual extension

      • cmd.exe (PID: 4880)
      • cmd.exe (PID: 5244)
      • cmd.exe (PID: 3252)
      • cmd.exe (PID: 4552)
      • cmd.exe (PID: 6872)
      • cmd.exe (PID: 4412)

    • Reads security settings of Internet Explorer

      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 2536)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 4408)
      • ShellExperienceHost.exe (PID: 416)
      • StartMenuExperienceHost.exe (PID: 3288)
      • StartMenuExperienceHost.exe (PID: 4120)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 3648)
      • StartMenuExperienceHost.exe (PID: 2288)
      • StartMenuExperienceHost.exe (PID: 3272)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 1984)

    • Starts CMD.EXE for commands execution

      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 2536)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 4408)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 3648)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 1984)

    • Reads the date of Windows installation

      • StartMenuExperienceHost.exe (PID: 3288)
      • StartMenuExperienceHost.exe (PID: 4120)
      • StartMenuExperienceHost.exe (PID: 2288)
      • StartMenuExperienceHost.exe (PID: 3272)

    • Write to the desktop.ini file (may be used to cloak folders)

      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 5216)

  • INFO

    • Checks supported languages

      • chcp.com (PID: 4844)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 2536)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 7076)
      • OfficeClickToRun.exe (PID: 3964)
      • ShellExperienceHost.exe (PID: 416)
      • StartMenuExperienceHost.exe (PID: 3288)
      • chcp.com (PID: 3500)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 4408)
      • chcp.com (PID: 3688)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 3648)
      • OfficeClickToRun.exe (PID: 5296)
      • StartMenuExperienceHost.exe (PID: 4120)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 5216)
      • chcp.com (PID: 3644)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 5540)
      • StartMenuExperienceHost.exe (PID: 2288)
      • chcp.com (PID: 1232)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 1984)
      • chcp.com (PID: 3224)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 3352)
      • StartMenuExperienceHost.exe (PID: 3272)

    • Process checks computer location settings

      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 2536)
      • StartMenuExperienceHost.exe (PID: 3288)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 4408)
      • StartMenuExperienceHost.exe (PID: 4120)
      • StartMenuExperienceHost.exe (PID: 2288)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 3648)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 1984)
      • StartMenuExperienceHost.exe (PID: 3272)

    • Reads the computer name

      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 2536)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 7076)
      • OfficeClickToRun.exe (PID: 3964)
      • ShellExperienceHost.exe (PID: 416)
      • StartMenuExperienceHost.exe (PID: 3288)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 4408)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 5216)
      • OfficeClickToRun.exe (PID: 5296)
      • StartMenuExperienceHost.exe (PID: 4120)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 3648)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 5540)
      • StartMenuExperienceHost.exe (PID: 2288)
      • StartMenuExperienceHost.exe (PID: 3272)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 3352)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 1984)

    • Manual execution by a user

      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 2536)
      • cmd.exe (PID: 5244)
      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 3648)
      • cmd.exe (PID: 4552)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6808)

    • Changes the display of characters in the console

      • cmd.exe (PID: 4880)
      • cmd.exe (PID: 5244)
      • cmd.exe (PID: 3252)
      • cmd.exe (PID: 6872)
      • cmd.exe (PID: 4552)
      • cmd.exe (PID: 4412)

    • Creates files in the program directory

      • 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe (PID: 7076)

    • Executes as Windows Service

      • OfficeClickToRun.exe (PID: 3964)
      • OfficeClickToRun.exe (PID: 5296)

    • Reads Microsoft Office registry keys

      • OfficeClickToRun.exe (PID: 3964)
      • OfficeClickToRun.exe (PID: 5296)

    • Reads the machine GUID from the registry

      • OfficeClickToRun.exe (PID: 3964)
      • OfficeClickToRun.exe (PID: 5296)

    • Checks proxy server information

      • OfficeClickToRun.exe (PID: 3964)
      • OfficeClickToRun.exe (PID: 5296)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 1980:00:00 00:00:00
ZipCRC: 0xff68f3f9
ZipCompressedSize: 109117
ZipUncompressedSize: 194560
ZipFileName: 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
179
Monitored processes
37
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
416"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\dxgi.dll
1100C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1232chcp 65001 C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
1984"C:\Users\admin\Desktop\3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe" C:\Users\admin\Desktop\3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\advapi32.dll
2288"C:\WINDOWS\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mcaC:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\systemapps\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\startmenuexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wincorlib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2348\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2536"C:\Users\admin\Desktop\3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe" C:\Users\admin\Desktop\3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3224chcp 65001 C:\Windows\SysWOW64\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ulib.dll
3252"C:\WINDOWS\SysWOW64\cmd.exe" /C "C:\Users\admin\Desktop\SKEIWAMI.cmd" C:\Windows\SysWOW64\cmd.exe
3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
3272"C:\WINDOWS\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mcaC:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\windows\systemapps\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\startmenuexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wincorlib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
Total events
37 433
Read events
32 523
Write events
4 897
Delete events
13

Modification events

(PID) Process:(6808) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6808) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6808) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6808) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6808) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6808) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\22924839398.zip
(PID) Process:(6808) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6808) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6808) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6808) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
4
Suspicious files
2
Text files
17
Unknown types
0

Dropped files

PID
Process
Filename
Type
25363c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exeC:\Users\admin\Desktop\ISKAEQUK.cmdtext
MD5:F8A86789D402D48B0B47D8C4B3CE336A
SHA256:A721A42B202ECD7587F7FAB9BCF8104D9A36D138A466304FFF311B008929DD1B
70763c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exeC:\ProgramData\F8C6A8.icoimage
MD5:DA8482C498FE39E871B81B28C61E097A
SHA256:E3EDFEB4F36C4E79BCD2849B27001BF0F0072CB212D26FFB7A19A4469F711C6A
44083c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exeC:\Users\admin\Desktop\SIAEUKKO.cmdtext
MD5:F8A86789D402D48B0B47D8C4B3CE336A
SHA256:A721A42B202ECD7587F7FAB9BCF8104D9A36D138A466304FFF311B008929DD1B
6808WinRAR.exeC:\Users\admin\Desktop\3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3executable
MD5:505D23C7A66A02239056AC3CFED24132
SHA256:3C1B9DF801B9ABBB3684670822F367B5B8CDA566B749F457821B6481606995B3
25363c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exeC:\Users\admin\Desktop\IQQUKOAE.cmdtext
MD5:F8A86789D402D48B0B47D8C4B3CE336A
SHA256:A721A42B202ECD7587F7FAB9BCF8104D9A36D138A466304FFF311B008929DD1B
25363c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exeC:\Users\admin\Desktop\CCGKOOEU.cmdtext
MD5:F8A86789D402D48B0B47D8C4B3CE336A
SHA256:A721A42B202ECD7587F7FAB9BCF8104D9A36D138A466304FFF311B008929DD1B
25363c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exeC:\Users\admin\Desktop\IQCKAUKQ.cmdtext
MD5:F8A86789D402D48B0B47D8C4B3CE336A
SHA256:A721A42B202ECD7587F7FAB9BCF8104D9A36D138A466304FFF311B008929DD1B
44083c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exeC:\Users\admin\Desktop\AOSWIMCO.cmdtext
MD5:F8A86789D402D48B0B47D8C4B3CE336A
SHA256:A721A42B202ECD7587F7FAB9BCF8104D9A36D138A466304FFF311B008929DD1B
44083c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exeC:\Users\admin\Desktop\KOGKOSEU.cmdtext
MD5:F8A86789D402D48B0B47D8C4B3CE336A
SHA256:A721A42B202ECD7587F7FAB9BCF8104D9A36D138A466304FFF311B008929DD1B
44083c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3.exeC:\Users\admin\Desktop\SKEIWAMI.cmdtext
MD5:F8A86789D402D48B0B47D8C4B3CE336A
SHA256:A721A42B202ECD7587F7FAB9BCF8104D9A36D138A466304FFF311B008929DD1B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
22
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
814 b
whitelisted
5352
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
NL
binary
408 b
whitelisted
2520
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
5352
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
NL
binary
420 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5172
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2520
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2520
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 95.101.149.131
whitelisted
login.live.com
  • 40.126.32.133
  • 40.126.32.140
  • 20.190.160.130
  • 40.126.32.68
  • 20.190.160.66
  • 20.190.160.67
  • 20.190.160.17
  • 20.190.160.3
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
nexusrules.officeapps.live.com
  • 52.111.243.31
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
22924839398.zip